Summary
Progress Software has issued an urgent advisory warning customers of two serious vulnerabilities in its MOVEit Automation tool. The flaws include an authentication-bypass vulnerability tracked as CVE-2026-4670 and a privilege-escalation vulnerability that could allow attackers to improperly access business data and escalate their access within affected environments.
Progress is urging customers to immediately upgrade to patched versions of MOVEit Automation. Given the history of MOVEit vulnerabilities being rapidly weaponized — most notably the devastating Cl0p ransomware campaign of 2023 — security teams are treating this disclosure with maximum urgency.
Source
Cybersecurity Dive — New MOVEit Vulnerabilities Prompt Urgent Patch Warning
Commentary
MOVEit is becoming the gift that keeps on giving — for attackers. The 2023 Cl0p campaign that exploited MOVEit Transfer impacted over 2,600 organizations and 90 million individuals. The mere mention of new MOVEit vulnerabilities should trigger immediate incident response playbooks at any organization running Progress Software products.
The combination of authentication bypass plus privilege escalation is particularly dangerous — it provides a complete attack chain from unauthenticated access to full system control. If you’re running MOVEit Automation, drop what you’re doing and patch. History has shown that exploit development for MOVEit flaws is measured in days, not weeks.